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Subjects Application of Subsection ( ra ) of the Privacy Act 


Attached for your information it a recent legal opinion from 
■the OMB Office of General Counsel interpreting the applic- 
ability of subsection (m) of the Privacy Act to certain 
research and other contracts. 


We request that you review your agency's policies and 
procedures for handling personal records under the control 
of contractors to assure that these records systems are 
maintained in accordance with this interpretation of the 
Privacy Act. 

If there are any questions, pletse contact the Informaticr 
Systems Policy Division at 395-3785. 


Sincerely , 



Walter W. Haase 

Deputy Associate Director 

for Information Systems Policy 


Attachment 
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November 30, 1979 


MEMORANDUM FOR: 

FROM i 
SUBJECT: 


Mary M. Coggin, Chief 
Administrative Lav Branch, HEW 

William M. Nichole 

Application of Subsection (m) of the 
Privacy Act 


. A f in response to your request for our comments on the 
HEW interpretation of the application of aubBection (rc) of 
the Privacy Act <5 U.S.C. 552a) to certain research and 
other (unspecified) contracts. Subjection (m) provides 
that: 


"When an agency provides by a contract for the 
operation by or on behalf of the agency of a 
system of records to accomplish an agency function, 
the agency shell, consistent with its Authority, 
cause the requirements of this section to be 
applied to such system. For purposes of subsection 
(i) of this section any such contractor and any 
employee of such contractor, if such contract 
is agreed to on or after the effective date of 
this section, shall be considered to be an 
employee of an agency." 

The HEW position, as stated in the memorandum entitled 
"Application of Privacy Act to HEW Contracts,"- from William 
H. Taft, General Counsel, to John Ottina, Assistant Secretarv 
for Administration and Management, dated Kay 17, 1976 (so- 
called "Taft memorandum"), is that: 

" • . .the requirements of the Privacy Act of 
1974 are not applicable to HEW research and 
other contracts which call for the contractor 
merely to furnish to the HEW contracting 
agency statistical or other reports, even 
though it ie necessary for the contractor 
to establish a system of records to perform 
the contract. 

* * * 
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Where the contracting agency ia interested 
only in obtaining the results of the research 
other work performed under the contract 
(generally in the fonn of a report) and does 
not require the contractor to furnish it 
individually identifiable records from the 
system established by the contractor, it 
cannot be said that the system is one which 
•but for’ the contract, the agency would 
have established." (Taft memo, p. 2). 

We disagree with thin interpretation. The application of 
Subsection (m) is not. dependent upon the disclosure of 
individually identr l iable records by the contractor to t.ie 
agency. Nothing in the statute, its legislative history, or 
the 0MB Privacy Act implementation Guidelines (40 Fed . g g 9« 
NO. 132, Wedneseday, July 9, 1975, p. 28948} supports s^ 
a reading of the law. 

The contract puts the personally identifiable information 
into the hands of the contractor. The data would have been 
collected and maintained by the agency if the work performec 
under contract had remained in-house. The contractor is 
performing an agency function and the Act applies. 
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ADMINISTRATION OF THE PRIVACY ACT OF 1974 


Office of Manaqement and Budqet 
Information Systems Policy Division 
J inuary 4 , 1980 
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FOREWORD 


The Privacy Act of 1974 (Public Law 9 '.-579) was enacted to 
ensure an appropriate balance between the Federal Government's 
need for information about its citizens and the individual's 
right to privacy. The Act seeks to achieve this objective 
by establishing procedures ft? regulate the collection, mainte- 
nance, use and dissemination of personal information by 
Federal agencies. The Act establishes a system of checks and 
balances to ensure the effective operation of these procedures. 
These checks and balances include provisions for the exercise 
of individual rights, public scrutiny of agency recordkeeping 
practices. Office of Management and Budget and congressional 
oversight of agency activities, and both civil and criminal 
sanctions . 

This document summarizes OMB activities to implement the Act 
and outlines the internal processes established by OMB to 
exercise its oversight: responsibilities under the Act. This 
document is being provided to Federal agencies and the public 
to foster a greater understanding of how the administrative 
processes work, and to provide greater opportunities for the 
public to participate in these processes by understanding how 
they work and by making suggestions for their improvement. 
Comments and suggestions are welcome. 


Walter W. Haase 

boputy Associate Director 

for Information Systems Policy 
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BASIC PRO VI S IONS OF THE ACT 

The Privacy Act of 1974 recognizes a fundamental right of 
individual privacy, and sets forth a system of checks and 
balances to regulate the collection, maintenance, use and 
dissemination of personal information by the Federal 
Government. The provisions of the Act are designed to 
achieve a balance' between the Government's need for infor- 
mation and the individual's right to privacy. The Act: 

1. Esta blishes certain rights of indi vidu al s . Individuals 
must be permitted to; 

° Know the authority under which information about 
them is collected, the purpose for which it is 
collected, how it will be used, and the effect on 
them of not providing information. 

0 Review agency records about them and to review 
agency records, on any disclosure of this informa- 
tion . 

° Request, that personal information which they 
believe to be incorrect be amended, corrected or 
removed . 

° Appeal agency denials of requests for amendment 
or correction. 

° Sue an agency in U.S. District Court for certain 
violations of the Act. 

2 • Makes the head s _qf _ Federal agen cies responsible and 

accountab le for comply ing with operational requiremen ts 
establish ed by the Act. Agency heads must: 

° Appropriately balance the Government's need for 
information with an individual's right to privacy. 

0 Comply with standards and procedural provisions 
of the Act pertaining to the collection, mainte- 
nance, use and dissemination of personal informa- 
tion . 

0 Collect and maintain only that personal infor- 
mation which is relevant and necessary to carry 
out agency functions authorized by law or executive 
order . 

0 Ensure that individuals are given a way to exercise 
their rights under the Act. 
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° Open their aqenci.es' norsona] recordkeeping practices 
to public scrutiny. 

° Safeguard personal data and prevent its unauthorized 
disclosure . 

3. Provides for enforcement of the provisions of the Act 

through a number of ch e cks , ‘ ba la nces "and ‘sanctions . 

The Act, which is based on the concept of agency 
accountability, provides for enforcement through: 

° The exercise of rights by individuals. 

° Subjecting the agency's persona] recordkeeping 
practices to public scrutiny, 

° Civil sanctions which can be exercised against the 
Government for certain violations. 

° Criminal sanctions which can be exerci sed against 
any Federal employee for certain violations and 
against members of the public at larqe for certain 
violations . 

4. Makes 0MB resp onsible for overseeing administration 
* of the Act ■ .Specifically, 0 MB must: 

° Provide guidelines and regulations for use by 
the agencies. 

0 Provide continuing assistance to agencies. 

0 Oversee the procedural mechanisms established by 
the Act. 


j MPJ..KMRNTATTON APPROACH 

0MB ' s approach to implementing and overseeing administra- 
tion of the Act has been directed toward: 

1. Ensuring that the heads of agencies and Federal 
employees understand their obligations and responsi- 
bilities under the Act. 

2. Developing and issuing guidelines and Otherwise 
assisting agencies in their implementa t ion of the 
provisions of the Act. 

3. Allowing for agency discretion in the manner by which 
they fulfill their responsibilities under the Act, by 
minimizing issuance of regulations and detailed pro- 
cedures by 0MB . 
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4. Closely monitor! nq agencies' administration of the Act 
calling their attention to apparent violations, and 
requesting them to take appropriate corrective action, 

5. Using existing management control processes and the 
people administering those processes wherever possible 
to assist in administering the requirements of the Act 

6. Establishing a system of checks and balances to ensure 
effective operation and enforcement of the Act. 

Consistent with this approach, OMB lias delegated responsi- 
bility for developing privacy policy guidance (within the 
framework of OMB policy and oversight) to a number of other 
central policy agencies. For example: 

The Director of t no Office of Personnel Management 
(formerly the Civil Service Commission) was made 
responsible for revising Federal personnel manage- 
ment regulations to reflect privacy considerations 
thereby making al 1 agency personnel officers 
responsible for assuring compliance with Federal 
personnel privacy policies and procedures. 

, ° The Administrator of the General Services Adminis- 

tration war; made responsible for revising Federal 
records storage and archivina regulations to in- 
corporate pr ivacy considerations — — thereby making 
those considerations part of the job of every 
records manager. 

Similar assignments of responsibility were made in 
other functional areas such as ptoCurement and 
clearance of reports under the Federal Reports Act. 
Each assignment was made to take advantage of exist- 
ing functional processes and incorporate privacy 
considerations into the day-to-day operations of 
existing organizations. 

Many of the OMB oversight functions have been 
incorporated in the existing budget and legislative 
review processes. 

This approach: 

Instills privacy awareness and consciousness in 
a larger number of people than would be possible 
by other means. 

0 Takes advantage of the functional expertise which 
exists in various central policy agencies. 
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Makes privacy consideration a responsibility of 
many people — all of whom are subject, to criminal 
sanctions for certain improper actions. 

Avoids excessive costs by using existing administra- 
tive processes and personnel „ 


j •or. icy gui dan ce 

A wide range of policy, guidelines and interpretations of 
the requirements of the Act has been developed and issued 
to guide agencies in their administration of the Act The 
most significant of these are listed below. 


Presidential Po licyjDi reef 

° President Ford's January 
signing of the Act. 


i on 


975 pres" release issued upon 


s September 29, 1975 statement 


President Ford' 

the effective date of the Act stressed 
of the Act and his support for 


it, 


issued on 
the importance 


President Ford's July 20, 1976 letters to the Speaker 
of the House and the President of the Senate transmitted 
the First Annual Report to Congress on executive branch 
activities to comply with the Privacy Act. 

President Carter's June 30, 1977 letters to the Speaker 
of the House and the President of the Senate transmitted 
the Second Annual Report to the Congress on executive 
branch activities to comply with the Privacy Act. The 

i^trnsfnn en f ors J d the eff °rts of 0MB to reduce Government 
tho c int ° the prlvate lives of Americans and urged 
the Congress to consider the Federal experience in de- 
liberations on future privacy legislation. 

President Carter's July 20, 1978 letters to the Speaker 

t ml!- H 2 USe and thc P res ident of the Senate transmitted 
the Third Annual Report to Congress on executive branch 
activities to comply with the Privacy Act. The President 

indicated that personal privacy was an important priority 
of his Administration. priorio., 

President Carter's August 71, 1978 memorandum to the heads 
of executive departments nrd agencies requested agency 
heads to initiate further efforts to reduce the amount of 
personal information collected by their agencies, avoid 
the unwarranted disclosure of this information and improve 
their internal management of personal data systems. P 
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0 President Carter's April 2, 19 7 9 message to Congress 
announced a wide range of initiatives to protect 
individual privacy. To implement those policies the 
President proposed four new hills providing privacy 
protection for medical records, federally funded re- 
search records, financial records, and news media notes 
and materials. The President asked that new procedures 
be set for Federal agencies' administrative actions and 
called for action by State and local governments and th« 
private sector to voluntarily adopt recordkeeping 
practices which would provide an appropriate level of 
protection for individual privacy. 

President Carter's August 16, 1979 letters to the 
Speaker of the House and the President of the Senate 
transmitted the Fourth Annual Report to Congress on 
executive branch activities to comply with the Privacy 
Act. The President urged the Congress to carefully 
consider the Administration's record of progress in 
implementing the Act as i t considered the Administra- 
tion's legislative proposals on individual privacy. 

0MB Policy _Direct i on 

. ° 0MB Circular No. A-IOR dated July 1, 1975, outlines 

agency responsibilities for implementing and administer- 
ing the Act. 

- T.M. No. i, dated September 30, 1975, sets forth 
agency requirements for proposals to establish or 
alter personal data systems. 

- T.M. No. 2, dated March 25, 1976, and T.M. No. 4, 
dated January 31, 1978, set forth agency reporting 
requirements for the annual report to Congress. 

- T.M. No. 3, dated May 17, 1976, sets forth revised 
guidance on agency proposals to establish or alter 
systems, establishes a provision for waiving the 60 
day advance notice period, and provides for public 
review of the new system proposals. 

- T.M. No. 5, dated August 3, 1978, transfers to 0MB the 
responsibilities for issuing policies regarding Govern* 
merit telccommun i cat i ons relai ive to the Privacy Act. 

Guidelines to agencies for implementing the Privacy Act 
issued by 0MB as a supplement to 0MB Circular No. A-10R 
on July 1, 1975 and amended on November 21, 1975. 

0 Director Lance's memorandum to agency heads, dated March 

7Ap|MWe?d Fdf Re1gSs&i20a2/07/03T C£JA<^Pprfl0a7^C®02Q0i^fiai£i:% on 
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the reduction of personal recordkeeping in the course of 
efforts to reduce public reporting burden. This 
letter was followed by individual letters to heads of 
15 major recordkeeping agencies requesting specific plans 
for reducing personal recordkeeping by their agencies. 

° Director Lance's August 3, 1977 memorandum to agency 
heads, transmitted the President's Second Annual Report 
to the Congress and requested further efforts at 
reducing personal recordkeeping. 

° 0MB Circular No. A-71, T.M. No. 1, "Security of Federal 
Automated Information Systems," was issued on July 27, 
1978 to ensure protection of personal, proprietary and 
other sensitive data in Government computers. 

° Director McIntyre's March 30, 1979 memorandum to agency 
heads provided guidelines to agencies for computer 
matching of personal records. 

° Director McIntyre's May 22, 1979 memorandum to agency 
heads summarized President. Carter's privacy initiatives 
and required each agency head to designate an office 
or official to bear oversight responsibility for the 

4 administration of the P -ivacy Act within that agency. 

° Mr. Walter W. Haase's January 2, 1980 memorandum to 
agency Privacy Act oversight officials transmitting 
an 0MB legal opinion regarding the application of 
Privacy Act requirements for publishing systems of 
records to research and other contractors who maintain 
agency records containing personal data. 

Office of Pers on nel M an age me n t _ Policy Direc tion 

0MB Circular No. A-108 assigned the Office of Personnel 

Management responsibility for revising civilian personnel 

recordkeeping policies to conform with the Act and to 

train agency personnel in the requirements of the Act. 

Policy guidance issued by 0PM includes: 

0 Revision of Federal Personnel Manual, Chapters 293 and 
297, September 30, 1975. 

° Notices describing the operation of four government-wide 
systems of personnel records which are maintained for 
0PM by operating agencies published August 27, 1975 and 
May 29, 1979. 

0 Regulations for r he comuct of Federal service suitabil- 
ity investigations. F PM Chapter 736, December 4, 1975. 
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° Federal 
Program 
Systems 


Personnel Majmal letter 7.32-7 
for Posit ions Associated with 
" November 14, 1978. 


"Personnel SecurU y 
Federal Computer 


General Services Admini stra ti on Policy Guidance 


The Act assigned rospo 
agency publication of 
the Annual Compilation 
No. A-108 assigned GSA 
policies pertaining to 
management and storage 
forms, and in the pror 
systems. Policy guida 


nsibi lity to the’ GSA for coordinating 
Privacy Act notices and for preparirg 
°f rules and notices. 0MB Circulat 
responsibility for the issuance of 
privacy consideration in records 
, in interagency data collection 
urement of comput er/communicat ions 
nee issued by GSA includes: 


O 


"Guidelines for Records 
the Privacy Act," issued 
Records Service, August 


Management Systems to Implement 
by the National Archives and 
1975. 


° GSA Bulletin FPMR B-5 7, dated August 22 
agency records stored in Federal records 


1975, regarding 
centers . 


J 


O 


FPMR Temp. Reg. p-4 3, 
list," dated October 
of privacy and other 
agency procurement of 


"ADP and Telecommunications Check- 
17, 1975, establishing a checklist 
requirements to be considered in 
computer and communications system:;. 


FPR Amendment 155, dated September 23, 1975, establishing 
rules and procedures tor Government contracts involving 
personal recordkeeping. 


O 


FPMR 101-35.1 
Security for 


7, dated Juno 16, 1978, "Privacy and Data 
ADP and Telecommunications Systems." 


Publication requirements for the Privacy Act of 1974 

June 11 ' 1975 ' updated April 8, 1977 and June 1, 


Department of Commerce Policy Guidance 

OMB Circular No. a- 108 assigned the National 
Standards ( NBS ) responsibility for developint 
standards and guidelines on computer security 
issued includes: 


Bureau of 
and issuing 
. Guidance 


O 


FIPS Pub 41 'Computer Security 
menting the Privacy Act of 1974 


Guidelines for 
dated May 30 


Imple- 
, 1975. 


° "Index of Automated 
October 1975. 


System Design Requirements 


" dated 



O 
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0 NBS Technical Note 906, "A Methodology for Evaluation 
of Alternative Technical and Information Management 
Approaches to Privacy Requirements." 

° Special Publication 500-10, "A Data Base Management 
Approach to Privacy Act Compliance." 

Department o f Ju s 1 1 c o Po I icy Guid ance 

The Department of Justice has issued two policy letters 
regarding the Privacy Act: 

0 Establishment of: "routine uses” for the referral of 
information for law enforcement and Federal employment 
purposes, dated June 5, 1975. 

° Disclosure of Payroll Information to State/ local Taxing 
Jurisdiction in the Absence of Withholding Agreements, 
dated March 23, 1976. 

Privacy Act Litig at i o n 

The Act and all the policies, procedures and regulations 
which have been established to implement the Act are 
.designed to seek an appropriate balance between Government 
needs for personal information and an individual's right 
to privacy. This balancing of conflicting interests will 
inevitably result in differences of judgment between 
individuals and the Government which can only be resolved 
in the courts. This case law will, over time, provide 
additional interpretive guidance. During 1976 and 1977, 

210 suits were filed. At: the end of 1978, 101 suits 
remained unresolved. 

Since the Privacy Act and the Freedom of Information Act 
(FOIA) are both parts of the same statute (5 U.S.C. 551 et . 
seq . ) and deal wich access to Government records, many 
lawsuits are brought under both Acts. Thus, FOIA and 
Privacy Act case laws are related and familiarity with both 
is helpful to an understanding of either. 

INVENTORY OF FEDERAL PERSONAL DATA SYSTEMS 


A computerized inventory of all Federal, personal data 
systems subject to the Act is maintained by OMB to: 

° Describe the size, nature and purpose of personal infor- 
mation systems maintained by Federal agencies. 
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° Observe and analyze agency use of the exemption provi- 
sions, use of computers for processing personal data, 
and a wide variety of other trends as a basis for 
formulating further policy by 0MB. 

0 Measure agency accomplishments in reducing (or curtail- 
ing growth in) the number and type of personal records 
which they maintain. 

The 1978 inventory contained description of 5,881 personal 
data systems maintained by Federal agencies. It is 
periodically updated based on information contained in 
agency reports on new and altered systems submitted to OMB 
and information contained in agency systems notices 
published in the Feder al Regist e r. 

Annually, the agencies are asked to validate and update 
the inventory as a part of the information which they 
submit for the President's Annual Report to Congress. 

PRES IDENT ' S ANNUAL RE POR T TO CONGRESS 

The Privacy Act requires the President to report annually 
to the Speaker of the House and President of the Senate on 
* executive branch activities to comply with the Privacy Act. 
OMB prepares the ^resident's Report based on agency reports. 

Consistent with the policy of agency accountabi 1 ity for 
complying with the requirements of the Act, agencies are 
required to provide annual reports on their administration 
of the Act to OMB. The requirements placed on agencies by 
OMB stress reporting of: 

° Agency accompli shraonts and plans for protecting individual 
privacy and reducing the magnitude of personal records 
maintained by the agency. 

° Agency actions to ensure that individuals are allowed to 
exercise their rights, to open their recordkeeping 
practices to public scrutiny, and to administer the 
exemption provision. 

0 Agency recommendations on actions that should be taken to 
address major problems that have arisen in their adminis- 
tration of the provisions of the Act -- through changes Ln 
Administration policies or by seeking legislative changes 
to the Act. 

The agency reports are analyzed by OMB and used to prepare 
the President's Annual Report to Congress. To date, four 
annual reports have been submitted to Cohgress, one bv 
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REV IEW OF AGENCY RUL E F, AN D_ NOT ICE S 

The Act requires agencies to publish rules (in accordance 
with the Administrative Procedure Act) to advise the public 
of procedures for exercising their rights under the Act and 
agency justification for invoking certain exemptions per- 
mitted by the Act. If. also requires agencies to annually 
publish notices describing each of their personal data 
systems subject to the Act in order to provide for public 
review of their roeordkoopi nq practices. 

The Act required agencies to publish these rules and initial 
notices by September 21 , 1975. OMB convened a task force oi 

agency personnel to assist agencies in preparing and issuinc 
their rules in accordance wi. th the requirements of the Act 
and to achieve some degree of consistency in rules for 
similar systems. 

The OMB staff oversees agency rulemaking and the publication 
of notices by reviewing the Federal Register daily and 
providing comments on agency issuances as necessary. 

REVI EW OF RE PORTS ON NEW AN D ALTEREDS YSTEMS 

The Act states that "each agency shall provide adequate 
advance notice to Congress and the Office of Management 
and Budget of any proposal to establish or alter any 
system of records in order to permit an evaluation of the 
probable or potential effect of such proposal on the 
privacy and other personal or property rights of individ- 
uals. . . " 

OMB policies implementing this provision require agencies 
to submit reports on proposed new or altered systems (RONS) 
to Congress and OMB 60 days prior to the issuance of any 
data collection forms or instructions, 60 days before 
entering any personal information into the new or altered 
system, or 60 days prior to the issuance of any requests 
for proposals for computer and communications systems or 
services to support such systems, whichever is earlier. 

OMB Review o f RONE 

Each RONS is reviewed by OMB to: 

° Determine whether the agency has adequately complied with 
the reporting criteria established by OMB — in form and 
substance . 

° Determine whether the system is consistent with agency 
mission requirements. 
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° Determine whether appropriate consideration has been 
given to personal privacy consistent with the letter, 
spirit and intent of the Act. 

After such review, any action considered necessary is 
initiated with the agency. 

Public review of RONS 

While the new system reporting requirements were established 
primarily for the purposes of congressional and 0MB oversight 
over the development of new (or altered) systems by agencies, 
0MB has established a process to give the general public a a 
opportunity to comment on the agency proposals. 

A summary of agency proposals to establish or alter per- 
sonal data systems provided to 0MB and the Congress is 
published in the Federal RcgjLstejr by 0MB approximately 
every two weeks. ~~ 

° Copies of this public announcement are mailed directlv 
to the staff of Members of Congress who have indicated 
an interest in privacy, the trade press and a list of 
private citizens and organizations which have indicated 
- an interest in privacy. About 05 copies are distributed 

Waiver Procedures 


OMB procedures permit a waiver of the advance notice require- 
ment when the agency can show that the delay caused by the 
60 day advance notice would not be in the public interest. 

A waiver of the 60 day advance notice period does not relieve 
an agency of the obligation to publish a notice describing 
the system and allow 30 days for public comment on the pro- 
posed routine uses of fhe personal information to be 
col lected . 


CONSIDERATI 0 N OF PRIVACY IN THE BUD GET PROCESS 

Agency budget requests for information system development 
efforts, computer/ telecommunication hardware procurement 
and software development activities are given special 
emphasis in the OMB budget review process. Privacy is one 
of a number of important policy issues that are closely 
examined in this process. 

Internal OMB procedures for reviewing agency budget proposals 
establish stringent criteria for reviewing agency budget 
justifications for information processing activities. These 
procedures require a review of the agency justifications 
to ascertain that they -- 
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0 "Include a clear indication of the necessity for such 
data collections and the safeguards the agency will 
employ to preclude inadvertent or surreptitious access 
by unauthorized persons to such data," and that 

° "The acquisition of data processing and telecommunica- 
tion equipment should he reviewed to assure that the 
requirements of the Privacy Aoi (P.L. 93-579) have been 
met . " 

As a part of the Administration's multi-year budget 
initiative, OMB requires agencies to identify major 
computer and telecommunication system acquisitions in 
the current year, the budget year and each year for four 
years beyond the budget year. OMB provides this infor- 
mation to Congress in order to provide earlier opportu- 
nities for congressional review of agency plans. The 
list of acquisitions are provided to GS A to assist them 
in carrying out their computer procurement control 
functions. This additional review provides an opportu- 
nity to evaluate the probable impact of these systems on 
personal privacy. 


‘ CONSIDERATION OF PRIVACY IN THE LEGISLATI VE REVIEW PROCESS 

The legislative coordination and clearance responsibilities 
of OMB are an important corollary to OMB budget and manage- 
ment functions, since the President's program and budcet 
recommendations are dependent upon legislation to carry out 
the proposals. 

The OMB legislative coordination and clearance process in- 
cludes assisting in the preparation of the President's 
legislative program, coordinating and clearing of agency 
legislative reports and draft bills, responding to requests 
of committees of the Congress for OMB reports and testify- 
ing on pending bills and handling of enrolled bills. J 

The process is coordinated by a central staff in OMB which 
seeks the views and judgments of many people, both in OMB 
and throughout the Government, before advising the Presiden 
through the Director. it is through this means that privae 
is considered and balanced with other policy and budget 
considerations. 


Examples of recent bi] Is which involved privacy questions 
are the Tax Reform Act of 1976, the Social Services Amend- 
ments, and the Right, to Financial Privacy Bill. Other 
examples are agency draft bills on confidentiality of 


longitudinal medical studies, and standards for enlist 
ment in thc> Armed Forces. 


reau 
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HAND LING OF PUBL IC INQpJIR IRS 

OMB, by virtue of its oversight responsibilities, receives 
a large volume of inquiries by telephone: and mail about 
the Act. These include citizen complaints on Government 
actions, inquiries regarding rights and privileges under 
the Act, Foreign, State, and local government inquiries 
on U.S. Federal Government experience under the Act, and 
a wide range of other questions. 

Public inquiries are generally handled as follows: 

Informational inquiries or those seeking interpretation 

of Federal policy and experience are handled directly 
by 0MB . 1 

Complaints about a particular agency's practices are 
usually answered by providing individuals with infor- 
mation on their rights and agency responsibilities 
under the Act and then referring the complaint to the 
responsible agency. Follow-up action with the agency 
is initiated only in those cases where the agency does 

not appear to be fulfilling its responsibilities under 
the Act. 


JM PACT ON GOVERNMENT OPR RA TIONS 

A number of provisions of the Act were designed to chance 
existing agency practices on the collection and disclosure 
of personal data. These changes have had an impact on the 
patterns of information exchange about individuals. Ex- 
perience to date indicates that: 


The public is becoming more reluctant to provide personal 
data and willing to challenge Federal agency requests f c r 
information. 


Agencies are demonstrating more caution in exchanging 
personal data. 


Some agencies are experiencing difficulty in obtaining 
personal information from third party sources. They 
indicate that less information is being provided and the 
information that is provided is less candid. 


0 Inconsistencies between Federal, State, and local 
privacy laws have created some problems in obtaining 
personal information from academic institutions, 
lending organ izati ons and medical facilities. 
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However, no agency has indicated that the provisions of the 
Act have made it impossible to obtain information needed to 
carry out Federal programs. 

IMPAC T on priva cy of individuals 

While it is difficult, if not impossible, to quantify 
"privacy protection" achieved by the Act, there are a 
number of measures and subjective observations which 
suggest that the Act has had a significant impact on 
achieving a better balance between the Government's need 
for information and protecting an individual ' s right to 
privacy . 

° Review of agency proposals for new and altered systems 
and public scrutiny of agency recordkeeping practices 
suggest that the majority of personal information 
collected is proper and necessary to carry out Government 
functions . 

° Agencies report that (hey have received very few 

questions from Congress about their proposals for new 
or altered systems and very few comments from the public 
at large on their persona] recordkeeping practices as 
.described in public notices. 

0 Privacy administrators in the agencies believe that the 
privacy consciousness which has been created by the 
Act, coupled with its sanctions, has established a deter- 
rent to unnecessary or improper collection of personal 
information and has created greater sensitivity to proper 
and fair handling of such information. 

° During the first four years of the Privacy Act imple- 
mentation both the number of agency systems of personal 
records and the number of individual records have been 
significantly reduced. 

° Further statistics on the effects of the Act are contained 
in the four Annual Reports to Congress. 

In summary, OMB believes that the intended purposes of the 
Act are being achieved and that the agencies are sincerely 
working to establish and operate affective privacy protection 
programs. We draw this conclusion despite the fact that the 
effectiveness of privacy protection is not something that is 
susceptible to quantitative measurement and proof. Nor is it 
something that is possible to achieve merely by regulatory 
fiat. Rather, it can only be brought about by instilling a 
continuing concern for privacy in the consciousness of over 
two million Federal workers, many of whom are involved daily- 
in thAppiQA/4dFbPRelease:2OO2/0i7/»aii6I^RIiR8^T(Wi7?R^2§O^ip5l4-§n 
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personal records. The procedures which have been estab- 
lished to administer the hot, along with continual OMB 
congressional and public oversight, of these activities ’ 
have sensitized the Federal workforce to the concerns of 
privacy and are working to achieve the objectives of the 

AC t « 
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